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DETAILED ACTION 

1 . A Request for Continued Examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.1 14, and the fee set 
forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous office action 
has been withdrawn pursuant to 37 CFR 1.1 14. Applicant's submission filed on 7 
June 2010 has been entered. 

2. Claims 21 and 41 have been amended. Claims 1-20, 40 and 60-61 are canceled. No 
new claims have been added. Claims 42-59 and 62-63 are withdrawn. Thus, claims 
21-39 and 41-59 and 62-63 are currently pending in the present application and 
claims 21-39 and 41 have been examined. 

3. Any claim objection/rejection not repeated below is withdrawn due to Applicant's 
amendment. 

Priority 

4. Acknowledgment is made that the instant application is a continuation of Application No. 
08/699,712, filed 08/12/1996, now abandoned, which is a continuation-in-part of Application 
No. 08/388,107, filed 02/13/1995, now abandoned. 
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Claim Rejections - 35 USC §103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

6. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 
USPQ 459 (1966), that are applied for establishing a background for determining obviousness 
under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating obviousness 
or nonobviousness. 

7. Claims 21-23, 26-27, 29, 32-33, 36-39 and 41 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over Sudia (U.S. Patent No. 5,659,616) in view of Cheng et al. (U.S. 
Patent No. 5,544,322) and further in view of Mayaud (U.S. Pub. No. 2003/0144884). 

As per claim 21, Sudia discloses a method for providing access to an online 
service (". . .electronic commerce business" - e.g. col. 4, lines 52-53), the method 
comprising: 

receiving, at a first electronic appliance (a recipient user - e.g. col. 9, line 36), a 
first digital certificate from a second electronic appliance associated with a user (a 
sending user - e.g. col. 9, line 37) the first digital certificate attesting to at least one 
attribute of the user ("receiving a digital identifying certificate issued by a certifying 
authority and have a plurality of digital fields, at least one of said fields identifying said 
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user" - e.g. claim 1); 

determining, by the first electronic appliance, based at least in part on the first 

digital certificate, whether the user is authorized to access the online service ("When a 

recipient user (verifier) receives a transaction 5 1 from a sending user, the recipient first 

uses the sender's basic key certificate 55 to verify the sender's signature 52 on the 

transaction. . ." - e.g. col. 9, lines 36-40); 

issuing, by the first electronic appliance, based on the determination of whether 

the user is authorized to access the online service, a second digital certificate to the user, 

the second digital certificate attesting to the user's permission to access the online service 

("receiving a digital authorization certificate, separate from said identifying certificate 

and issued by a sponsor of said user, and authorizing transactions by said user..." - e.g. 

claim 1, ". .. .the recipient also uses the sender's authorization certificate 56, signed by the 

sender's sponsor 59, to verify..." - e.g. col. 9, lines 36-45) and collecting, by the first 

electronic appliance, information relating to the user's use of the online service (user 

transaction 1202 in fig. 12 and col. 13, lines 9-10. Please note user transaction 

corresponds to Applicant's information relating to the user's use of the online service) 

Please note further in col. 14, lines 5-18, Sudia also discloses ". . .it may often be helpful 

to the copy the user's public key out of his basic authentication certificate and include it 

as another attribute in an authorization certificate. This permits the authorization 

certificate to serve both purposes (authentication and authorization) and allows the sender 

to omit the basic authentication certificate from each transaction". It is clear that in the 

Sudia reference, the authentication and authorization certificates are either two separate 
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certificates or one authorization certificate to serve both authentication and authorization 
purposes. 

Although Sudia discloses receiving a digital authorizing certificate, separate from 
said identifying certificate and issued by a sponsor of said user (e.g. claim 1), Sudia does 
not explicitly disclose sending, from the first electronic appliance to the second 
appliance, the authorizing/authentication certificate (i.e. second digital certificate), 
however, Cheng et al. met the claim limitation by disclosing authentication server III 
waits for authentication request IV from client II (see step c3 below), and constructs and 
sends authentication certificate V to client II (e.g. col. 9, lines 1-3 of Cheng et al. Please 
note authentication server corresponds to Applicant's first electronic appliance and client 
II corresponds to Applicant's second electronic appliance). 

Sudia - Cheng et al. are analogous art because they are from a similar field of 
endeavor in authorizing online service via digital authentication/authorization certificate. 
Thus, it would have been obvious to a person with ordinary skill in the art, at the time of 
invention, to modify the teachings of Sudia with sending, from the first electronic 
appliance to the second appliance, the authorizing/authentication certificate (i.e. second 
digital certificate) taught by Cheng et al. in order to conform to the received 
authentication path (e.g. Cheng et al., col. 3, line 45). 

Although Sudia discloses collecting, by the first electronic appliance, information 
relating to the user's use of the online service (user transaction 1202 in fig. 12 and col. 13, 
lines 9-10. Please note user transaction corresponds to Applicant's information relating 
to the user's use of the online service, Sudia - Cheng et al. does not explicitly user 
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transaction is an audit record information. However, Mayaud, met the claimed limitation 
by disclosing an audit trail details of access to patient data by every physician user using 
a computer-implemented system (i.e. prescription management system) (e.g. par. [0001] 
and [0142] of Mayaud). 

It would have been obvious to a person with ordinary skill in the art, at the time of 
invention, to combine the teachings of Sudia - Cheng et al. with Mayaud's user 
transaction is an audit record information in order to provide a higher level of 
confidentiality by automatically maintaining a complete audit trial of access by each user 
(e.g. par. [0142] of Mayaud). 

This combination would predictably result a well known audit trail of access by 
each user to provide a higher level of confidentiality. It has been held that "[t]hc 
combination of familiar elements according to known methods is likely to be obvious 
when it does not more than yield predictable results." KSR., 127 S. Ct. at 1739, 
82USPQ2d at 1395 (2007) (citing Graham, 383 U.S. at 12). 

As per claims 22-23, Sudia further discloses receiving a request from the user to 
access the online service (". . .electronic commerce business" - e.g. col. 4, lines 52-53); 
checking the second digital certificate to determine whether the user has permission to 
access the online service ("verifying said transaction based on information in said 
identifying certificate and in said authorization certificate, said step of verifying including 
applying said rules. . .to verify. . ." - e.g. claim 1); and allowing the user to access the 
online service if it is determined that the user has permission to access the online service 
("accepting said transaction based on said outcome of said verifying. . ." - e.g. claim 1) 
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and in which said checking step is performed in a protected processing environment at a 
local computer system from which the user made the request to access the online service 
("a system for securely using digital signatures in a commercial cryptographic system. . ." 
- e.g. abstract). 

As per claims 26-27, Sudia further discloses providing a third digital certificate to 
the user, the third digital certificate attesting to the identify of the online service, the third 
digital certificate being issued by a certifying authority (e.g. col. 3, lines 48-67, col. 4, 
lines 10-38) and in which the first digital certificate is issued by the certifying authority 
("receiving a digital identifying certificate issued by a certifying authority and have a 
plurality of digital fields, at least one of said fields identifying said user" - e.g. claim 1). 

As per claim 29, Sudia further discloses in which the first digital certificate 
identifies a party responsible for paying for the user's access to online services 
(identifying said user - e.g. claim 1 and "user name" of user basic certificate of fig. 5) 

As per claim 32, Sudia further discloses in which the second digital certificate 
attests to the user's permission to access the online service until a specified date 
("Certificates also contain an expiration date. . ." - e.g. col. 4, lines 1-9). 

As per claim 33, Sudia further discloses in which the at least one attribute 
comprises an indication of the amount of purchases the user is allowed to make in a given 
time period (e.g. col. 11, lines 11-41). 

As per claims 36-37, Sudia further discloses in which the online service 
comprises a subscription (". . .into the attribute certificates of the CA and its subscribers.." 



Application/Control Number: 10/727,324 Page 8 

Art Unit: 2435 

- e.g. col. 7, lines 37-38) and in which the second digital certificate includes an 
expiration date of the subscription ("Certificates also contain an expiration date. . ." - e.g. 
col. 4, lines 1-9). 



As per claims 38-39, Sudia further discloses collecting payment information from 
the user (e.g. col. 12, lines 1-18) and further comprising: sending the payment 
information to a financial clearinghouse (e.g. col. 6, lines 1-15 and col. 12, lines 1-18). 

As per claim 41, Sudia - Mayaud further discloses sending the audit record 
information to a usage clearinghouse (e.g. col. 6, lines 1-15 and col. 12, lines 1-18 of 
Sudia and par. [0142] of Mayaud). 

8. Claims 24-25 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Sudia (U.S. Patent No. 5,659,616) in view of Cheng et al. (U.S. Patent No. 5,544,322)- Mayaud 
(U.S. Pub. No. 2003/0144884) and further in view of Arnold (U.S. Patent No. 5,956,408) 

As per claims 24-25, Sudia - Cheng et al. - Mayaud does not expressly disclose sending 
software to the user. However, this well known feature is disclosed in col. 1, lines 10-14 of 
Arnold reference. It would have been obvious to a person with ordinary skill in the art at the 
time of the invention to incorporate Arnold's sending software to the user with Sudia - Cheng et 
al. - Mayaud since sending software to the user assures security (e.g. Arnold, col. 5, lines 1-14). 

Arnold further discloses sending a digital signature for determining the integrity of the 
software to the user (Arnold, e.g. abstract) and in which the digital signature is bound, at least in 
part, to the identity of the online service (Arnold, e.g. abstract). 
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9. Claim 28 is rejected under 35 U.S.C. 103(a) as being unpatentable over Sudia 
(U.S. Patent No. 5,659,616) in view of Cheng et al. (U.S. Patent No. 5,544,322) - Mayaud (U.S. 
Pub. No. 2003/0144884) and further in view of Boulton et al. (U.S. Patent No. 5,537,618) 

As per claim 28, Sudia discloses a digital identifying certificate issued by a certifying 
authority and having a plurality of digital fields, at least one of said fields identifying said user 
(Sudia, e.g. claim 1). 

Sudia - Cheng et al. - Mayaud does not expressly disclose in which the first digital 
certificate includes an indication of the user's age. 

However, it is well known at the time of the invention age is an attribute to identity a 
user. This well known feature is disclosed in col. 37, lines 32-34 of the Boulton et al. reference. 

It would have been obvious to a person with ordinary skill in the art at the time of the 
invention to incorporate Boulton et al.'s age is an attribute to identity a user into Sudia - Cheng 
et al. - Mayaud since a user's age is one of the attributes that identifying the user. 

10. Claim 30 is rejected under 35 U.S.C. 103(a) as being unpatentable over Sudia 
(U.S. Patent No. 5,659,616) in view of Cheng et al. (U.S. Patent No. 5,544,322) - Mayaud (U.S. 
Pub. No. 2003/0144884) and further in view of Doggett et al. (U.S. Patent No. 5,677,955) 

As per claim 30, Sudia - Cheng et al. - Mayaud does not explicitly disclose sending a 
request for payment to the party responsible for paying for the user's access to online services 
and receiving an indication that payment has been received. 

However, Doggett et al. met the claimed limitation by disclosing the payer 12 receives a 
bill or invoice from the payee and the payer's bank, in turn, transfers funds to the payee 's 
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account at the payee 's bank, which sends a record of the transaction to the payee with accounts 
receivable information (e.g. par. 17, lines 30-57). 

It would have been obvious to a person with ordinary skill in the art at the time of the 
invention to incorporate Doggett et al.'s sending a request for payment to the party responsible 
for paying for the user's access to online services and receiving an indication that payment has 
been received into Sudia - Cheng et al.- Mayaud in order to collect payment of the transaction. 

This combination would predictably result a well known collect payment for a service. It 
has been held that "[t]he combination of familiar elements according to known methods is likely 
to be obvious when it does not more than yield predictable results." KSR., 127 S. Ct. at 1739, 
82USPQ2d at 1395 (2007) (citing Graham, 383 U.S. at 12). 

1 1 . Claim 3 1 is rejected under 35 U.S.C. 103(a) as being unpatentable over Sudia 
(U.S. Patent No. 5,659,616) in view of Cheng et al. (U.S. Patent No. 5,544,322) - Mayaud (U.S. 
Pub. No. 2003/0144884) and in view of Doggett et al. (U.S. Patent No. 5,677,955) and further in 
view of Gifford (U.S. Patent No. 5,724,424). 

As per claim 31, Sudia - Cheng et al. - Mayoud - Doggett et al. does not explicitly disclose 
steps in which the steps of (a) sending a request for payment and (b) receiving an indication that 
payment has been received are performed prior to performing the step of sending the second 
digital certificate to the user. 

However, Gifford met the claimed limitation by disclosing a network payment service is 
used to authorize the purchase before merchant fulfillment is performed (e.g. col. 3, lines 24-26. 
Please note merchant fulfillment is performed corresponds to Applicant's sending the second 
digital certificate to the user). 
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It would have been obvious to a person with ordinary skill in the art at the time of the 
invention to incorporate Gifford's the steps of (a) sending a request for payment and (b) 
receiving an indication that payment has been received are performed prior to performing the 
step of sending the second digital certificate to the user into Sudia - Cheng et al. -Mayaud- 
Doggett et al. in order to pay before accessing service. 

This combination would predictably result a well known collect payment before 
accessing service. It has been held that "[t]he combination of familiar elements according to 
known methods is likely to be obvious when it does not more than yield predictable results." 
KSR., Ill S. Ct. at 1739, 82USPQ2d at 1395 (2007) (citing Graham, 383 U.S. at 12). 

12. Claims 34-35 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Sudia (U.S. Patent No. 5,659,616) in view of Cheng et al. (U.S. Patent No. 5,544,322) - Mayaud 
(U.S. Pub. No. 2003/0144884) and further in view of Rebane et al. (U.S. Patent No. 5,978,567) 

As per claims 34-35, Sudia - Cheng et al. - Mayaud does not expressly disclose in which 
the online service comprises an interactive online game. 

However, this well known feature is disclosed in the abstract, col. 1, lines 48-64, col. 3, 
lines 22-31 and col. 8, line 66 - col. 9, line 12. It would have been obvious to a person with 
ordinary skill in the art at the time of the invention to incorporate Rebane et al.'s the online 
service comprises an interactive online game into Sudia - Cheng et al. -Mayaud since online 
service comprises an interactive online game is offered electronically and interactively is well 
known in the art. (e.g. Rebane et al., col. 1, lines 48-64). 

Sudia-Rebane et al. further discloses sending software for playing the online game to the 
user in a secure container (Sudia, - e.g. abstract and Rebane et al. - e.g. col. 9, lines 37-52). 
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Respond to Amendment/Argument 

13. Applicant's amendments and argument have been fully considered, but are moot in view 
of new ground rejection as set forth below. It is noted that Applicant's arguments are directed 
towards limitations newly added via amendments. 

Conclusion 

14. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. (See PTO-892). 

Contact Information 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to APRIL Y. SHAN whose telephone number is (571)270-1014. 
The examiner can normally be reached on Monday - Friday, 8:00 a.m. - 5:00 p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on (571) 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/April Y Shan/ 
Examiner, Art Unit 2435 



